diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-01-27 02:08:22 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-01-27 02:11:19 +0100 |
| commit | 362271d72fc38cd1f4b076aff9a12b1104c26760 (patch) | |
| tree | e26cb8a200453bacb2780aaac37342d5fe4ff24b /libavformat/mvdec.c | |
| parent | 6512405ce20379f31e28c49599a46e9aa5647e7d (diff) | |
| download | ffmpeg-362271d72fc38cd1f4b076aff9a12b1104c26760.tar.gz | |
mvdec: Check the frame counter against the correct limit.
fixes out of array reads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/mvdec.c')
| -rw-r--r-- | libavformat/mvdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/mvdec.c b/libavformat/mvdec.c index c58567cad4..03471f1556 100644 --- a/libavformat/mvdec.c +++ b/libavformat/mvdec.c @@ -372,7 +372,7 @@ static int mv_read_packet(AVFormatContext *avctx, AVPacket *pkt) int ret; uint64_t pos; - if (frame < st->nb_frames) { + if (frame < st->nb_index_entries) { index = &st->index_entries[frame]; pos = avio_tell(pb); if (index->pos > pos) |